KB5122772: CVEs fixed (Windows update (KB))

KB5122772 fixes 4 tracked CVEs. Affected systems and fixed versions.

CVE-2026-47297 HIGH 8.1 UPGRADE UPGRADE Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network
CVE-2026-67636 CRITICAL 9.0 UPGRADE UPGRADE Out-of-bounds read in SQL Server allows an unauthorized attacker to execute code over a network.
CVE-2026-67378 CRITICAL 9.0 UPGRADE UPGRADE Untrusted pointer dereference in SQL Server allows an unauthorized attacker to execute code over a network.
CVE-2026-77484 HIGH 8.8 UPGRADE UPGRADE Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.

Applies to